qakbot | a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078

General

Target

a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll
Size

554KB
MD5

ac5fadde7c1c40afef7716420c4433bc
SHA1

c5eb80bfbef1dce11f2c504e17e201a3c6ca7257
SHA256

a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078
SHA512

314f5c185fb9681223562f5e5ce81d62d21e4394026677b23b316029ad01921d51933ca4d19061116b515cf4d8af970adeb22e1e8afe7011c256eda4aa4d8046

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1652 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe

pid	process
1652	regsvr32.exe

pid	process
568	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\411eb564 = 8d2589e0d9370a7ae15c7d731ef999d23bb80d33624d4868caf5b8638f050740eb71a6cd234ea0d5f1a46577	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\f9a2d201 = 64dae602a702a8f7698b4c7a2857b62efa0a62518bf2439739d48c905c4d24500b758ffd8fb0288aad769f4d543446ff9377417df7eac8c30b8dcec5938566467ec5903db9b4df8a4536fca0436b1dbeac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\9892aa0 = 11bd280e1403e584d18b364263c6d92bc66e2073b4c04b64e6238a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\76c04556 = 7dc1db41fb890c1c1c3e0e144d7a213037afdec695c72fe98a39699b7bf91727f8b0cbd02ef3b1d7120414cd5c3281444cb4ded988b523f2da313fc4e8a9800e8cce3d6355601000639ed80481b0ebf77ff4b801bf38e6a7dd8cf945b750c96db702174889c199a1b3045620	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiwryxyyj	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\76c04556 = 7dc1cc41fb893951a565019928cee32ed94880e6927ebe06c3657fd062c02b88a992c15dbb0bd71952d1e5a75156a201d3ddfaf4d3176c0d8957f8a0394b1602240ea6e962675000328a8dc1c0d91bfee71a708d4f8146	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\435f9518 = d51bc0b26963665a5f9df9af318c267d220dfa51365a9e48e73898a84d387cdff1fb1871b0635da99427a388c6c41d6ede256f769bf847f8f3810d3273c20b36e3d465903e83d674f970c110af8cc7e44d2f1870b6ac00e2810f284172adfc1d1eb8067676bb09ec6e6b2546a926e7c876cfd9be4072e811c4dc760603cc85d632e444f39dad1f8381388c837aee25d7b6949a09e7fe914ceeb989139f7e387b1ceac030	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\84aa9d8b = f9aa17c323371697e37f52d49d85df1b5e64748a1c71379455724b48e90d0143d6e67b3fcb4a416f0814f3fe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\3c16faee = 3214ff942237ab222c3ef6dbee6034	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iiwryxyyj\fbe3f27d = a34e1f762f1c7abb52550ce61ee645bf	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1172 rundll32.exe
1652 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1172 rundll32.exe
1652 regsvr32.exe

pid	process
1172	rundll32.exe
1652	regsvr32.exe

pid	process
1172	rundll32.exe
1652	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1172	748	rundll32.exe	rundll32.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1152	1172	rundll32.exe	explorer.exe
PID 1152 wrote to memory of 568	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 568	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 568	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 568	1152	explorer.exe	schtasks.exe
PID 1552 wrote to memory of 964	1552	taskeng.exe	regsvr32.exe
PID 1552 wrote to memory of 964	1552	taskeng.exe	regsvr32.exe
PID 1552 wrote to memory of 964	1552	taskeng.exe	regsvr32.exe
PID 1552 wrote to memory of 964	1552	taskeng.exe	regsvr32.exe
PID 1552 wrote to memory of 964	1552	taskeng.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1652	964	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1652 wrote to memory of 1736	1652	regsvr32.exe	explorer.exe
PID 1736 wrote to memory of 2012	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2012	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2012	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2012	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2024	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2024	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2024	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 2024	1736	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mcytbowbqm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll\"" /SC ONCE /Z /ST 17:29 /ET 17:41
4⤵
- Creates scheduled task(s)
PID:568

C:\Windows\system32\taskeng.exe
taskeng.exe {9A6C8413-BF51-471E-89D3-E3CC286B1A90} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Njakgngyi" /d "0"
5⤵
PID:2012

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xywzireds" /d "0"
5⤵
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll
MD5
ac5fadde7c1c40afef7716420c4433bc

SHA1
c5eb80bfbef1dce11f2c504e17e201a3c6ca7257

SHA256
a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078

SHA512
314f5c185fb9681223562f5e5ce81d62d21e4394026677b23b316029ad01921d51933ca4d19061116b515cf4d8af970adeb22e1e8afe7011c256eda4aa4d8046

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll
MD5
ac5fadde7c1c40afef7716420c4433bc

SHA1
c5eb80bfbef1dce11f2c504e17e201a3c6ca7257

SHA256
a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078

SHA512
314f5c185fb9681223562f5e5ce81d62d21e4394026677b23b316029ad01921d51933ca4d19061116b515cf4d8af970adeb22e1e8afe7011c256eda4aa4d8046

Download Submit
memory/568-69-0x0000000000000000-mapping.dmp

Download
memory/964-71-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/964-70-0x0000000000000000-mapping.dmp

Download
memory/1152-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1152-65-0x0000000074311000-0x0000000074313000-memory.dmp

Filesize
8KB

Download
memory/1152-68-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1152-63-0x0000000000000000-mapping.dmp

Download
memory/1172-56-0x00000000001D0000-0x000000000025F000-memory.dmp

Filesize
572KB

Download
memory/1172-66-0x0000000000870000-0x0000000000891000-memory.dmp

Filesize
132KB

Download
memory/1172-67-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/1172-54-0x0000000000000000-mapping.dmp

Download
memory/1172-60-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/1172-58-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/1172-59-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/1172-57-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1172-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1172-61-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/1652-78-0x0000000000890000-0x00000000008B1000-memory.dmp

Filesize
132KB

Download
memory/1652-76-0x0000000000800000-0x000000000088F000-memory.dmp

Filesize
572KB

Download
memory/1652-77-0x0000000000890000-0x00000000008B1000-memory.dmp

Filesize
132KB

Download
memory/1652-80-0x0000000000890000-0x00000000008B1000-memory.dmp

Filesize
132KB

Download
memory/1652-79-0x0000000000890000-0x00000000008B1000-memory.dmp

Filesize
132KB

Download
memory/1652-82-0x0000000000890000-0x00000000008B1000-memory.dmp

Filesize
132KB

Download
memory/1652-81-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1652-73-0x0000000000000000-mapping.dmp

Download
memory/1736-84-0x0000000000000000-mapping.dmp

Download
memory/1736-90-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2012-88-0x0000000000000000-mapping.dmp

Download
memory/2024-89-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads